terraform commands

43 commands, each with a one-line explanation. Click a command to copy it, or its title for details.

Commands 43 shown

  • Plan with var file
    terraform plan -var-file=prod.tfvars -out=plan.tfplan

    Show changes; save plan artifact for CI gating

  • Apply a saved plan
    terraform apply plan.tfplan

    Apply exactly the previously generated plan — no interactive prompts

  • Import existing resource
    terraform import module.path.resource_type.name <remote-id>

    Bring an already-existing resource under Terraform control

  • Show state for a resource
    terraform state show module.path.resource_type.name

    Inspect Terraform state attributes for a single resource

  • Move resource in state
    terraform state mv old.address new.address

    Rename/reorganize resource without destroying and recreating it

  • Workspace list
    terraform workspace list

    Show all workspaces; current one marked with *

  • Create and switch workspace
    terraform workspace new staging && terraform workspace select staging

    Create a new workspace and switch to it

  • Validate configuration
    terraform validate

    Check Terraform configuration for syntax and consistency errors

  • Format code
    terraform fmt -recursive

    Auto-format all .tf files recursively

  • Show output values
    terraform output -json

    Print all outputs as JSON; useful for pipeline scripting

  • Destroy specific resource
    terraform destroy -target=module.vpc.aws_vpc.main

    Destroy a single resource without touching everything else

  • Taint resource (force replace)
    terraform taint module.eks.aws_instance.node

    Mark resource for replacement on next apply

  • Remove resource from state
    terraform state rm module.path.resource_type.name

    Forget a resource from state without destroying it in cloud

  • Refresh state
    terraform refresh -var-file=prod.tfvars

    Update state file to match real infrastructure

  • Graph dependency tree
    terraform graph | dot -Tsvg > graph.svg

    Visualize resource dependency graph (requires Graphviz)

    debug

  • List state resources
    terraform state list | grep <pattern>

    Filter state resources by pattern

  • Format all files
    terraform fmt -recursive

    Recursively format all .tf files in subdirectories

  • Validate configuration
    terraform validate

    Check configuration syntax without accessing remote state

    debug

  • Plan with var file
    terraform plan -var-file=prod.tfvars -out=prod.tfplan

    Generate plan with prod variables, save to file

  • Apply saved plan
    terraform apply prod.tfplan

    Apply exactly the plan generated earlier (no re-prompts)

  • Show resource in state
    terraform state show 'aws_instance.web[0]'

    Display all attributes of a specific resource in state

    debug

  • Move resource in state
    terraform state mv 'aws_instance.web' 'module.app.aws_instance.web'

    Rename or move a resource without destroying it

  • Import existing resource
    terraform import 'aws_s3_bucket.mybucket' my-existing-bucket

    Bring an existing resource under Terraform management

  • Taint resource for recreation
    terraform taint 'aws_instance.web[0]'

    Mark resource to be destroyed and recreated on next apply

  • Remove resource from state
    terraform state rm 'aws_instance.legacy'

    Remove a resource from state without destroying it in the cloud

  • Show outputs
    terraform output -json | jq 'to_entries[] | {(.key): .value.value}'

    Print all outputs as compact JSON

  • Destroy specific resource
    terraform destroy -target='aws_instance.web' -auto-approve

    Destroy a single resource without full plan

  • Unlock stuck state
    terraform force-unlock <lock-id>

    Release a stuck state lock after a failed apply

    debug

  • Workspace create and switch
    terraform workspace new staging && terraform workspace select staging

    Create and activate a Terraform workspace

  • Show dependency graph
    terraform graph | dot -Tsvg > graph.svg && open graph.svg

    Render resource dependency graph as SVG (requires graphviz)

    debug

  • List providers with versions
    terraform providers lock -platform=linux_amd64 -platform=darwin_arm64

    Lock provider versions for multiple platforms in .terraform.lock.hcl

  • Move resource in state
    terraform state mv 'aws_instance.web' 'aws_instance.app'

    Rename/refactor address without destroy; prefer moved{} block in newer TF

    gitops · troubleshooting

  • Remove orphan from state
    terraform state rm 'aws_s3_bucket.legacy'

    Forget resource from state without deleting real infra; note: object keeps existing

    troubleshooting · cloud

  • Inspect single resource state
    terraform state show 'module.vpc.aws_subnet.private[0]'

    Dump all attributes of one resolved address for drift/debug investigation

    debug · troubleshooting

  • Grep the state list
    terraform state list | grep -i 'aws_iam'

    Filter managed addresses to find what TF tracks before surgery

    troubleshooting · security

  • Config-driven import block
    cat > import.tf <<'EOF' import { to = aws_instance.web id = "<id>" } EOF terraform plan -generate-config-out=generated.tf

    Declarative import; -generate-config-out scaffolds HCL for the imported object

    gitops · cloud

  • Refactor with moved block
    cat >> moved.tf <<'EOF' moved { from = aws_instance.web to = aws_instance.app } EOF

    Rename addresses in code with no destroy/recreate; survives in version control

    gitops · troubleshooting

  • Replace resource (modern taint)
    terraform apply -replace='aws_instance.web'

    Force destroy+recreate of one resource; replaces deprecated terraform taint

    troubleshooting · cloud

  • Surgical targeted plan
    terraform plan -target='module.db.aws_db_instance.main'

    Limit plan to one address; note: -target is an escape hatch, can mask drift

    troubleshooting · debug

  • Refresh-only plan (detect drift)
    terraform plan -refresh-only

    Sync state to real infra without proposing changes; surfaces out-of-band drift

    monitoring · troubleshooting

  • Migrate backend on init
    terraform init -migrate-state -backend-config=backend.hcl

    Move state to a new backend; use -reconfigure to skip migration and reset

    gitops · troubleshooting

  • Query outputs with jq
    terraform output -json | jq -r '.endpoints.value[]'

    Pipe machine-readable outputs into jq for scripting and downstream wiring

    ci · observability

  • Trace plan with TF_LOG
    TF_LOG=DEBUG TF_LOG_PATH=tf.log terraform plan

    Capture provider/API debug to a file; use TRACE for the most verbose level

    debug · troubleshooting